emma-coinbase-clone[.]netlify[.]app

The domain emma-coinbase-clone.netlify.app is a phishing site engaged in brand impersonation targeting Coinbase users. It poses an elevated risk as a cryptocurrency scam designed to deceive victims into disclosing login credentials or transferring digital assets, though no active drainer kit was detected. The site is currently taken offline, displaying a 'Site not found' error, but remains a documented threat due to its prior malicious activity.

Technical indicators confirm the domain's fraudulent nature. As of analysis, 2 of 95 VirusTotal security vendors flag emma-coinbase-clone.netlify.app as malicious, including ChainPatrol and alphaMountain.ai. The domain appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through Netlify on March 09, 2026, it resolves to IP address 63.176.8.218 (AS16509, Amazon.com, Inc., located in Germany). The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain. Technologies detected include Netlify hosting, HSTS enforcement, and DigiCert SSL, while Google Safe Browsing has not flagged the domain.

Users who interacted with emma-coinbase-clone.netlify.app should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized transactions or login attempts. If cryptocurrency was involved, revoke any token approvals granted to unknown contracts via wallet management tools like Etherscan or Revoke.cash. Report the phishing domain to Coinbase’s security team and submit it to platforms such as Google Safe Browsing, PhishTank, or Netlify’s abuse reporting system to prevent further exploitation.